Linuxfoundation
Page 5 of 6 — Linuxfoundation CVEs from a corpus of 557, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25882 | High | 7.5 | 2023-01-26 | Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file whi… |
CVE-2021-4314 | Medium | 5.3 | 2023-01-18 | It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only… |
CVE-2022-46463 | High | 7.5 | 2023-01-13 | An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's… |
CVE-2022-4875 | Low | 2.4 | 2023-01-04 | A vulnerability has been found in fossology and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sql/VarVal… |
CVE-2022-23506 | Medium | 4.3 | 2023-01-03 | Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine image… |
CVE-2019-19030 | Medium | 5.3 | 2022-12-26 | Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP… |
CVE-2022-23536 | Medium | 6.5 | 2022-12-19 | Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where… |
CVE-2022-23471 | Medium | 5.7 | 2022-12-07 | containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stre… |
CVE-2022-46770 | High | 7.5 | 2022-12-07 | qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of for… |
CVE-2022-45932 | High | 7.5 | 2022-11-27 | A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore… |
CVE-2022-45931 | High | 7.5 | 2022-11-27 | A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore… |
CVE-2022-45930 | High | 7.5 | 2022-11-27 | A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/DomainSto… |
CVE-2022-45907 | Critical | 9.8 | 2022-11-26 | In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely. |
CVE-2022-41939 | Medium | 6.1 | 2022-11-19 | knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised th… |
CVE-2022-39383 | Medium | 4.9 | 2022-11-16 | KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as th… |
CVE-2022-0324 | High | 8.1 | 2022-11-14 | There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that could cause buffer overflow in a memcpy… |
CVE-2022-32592 | Medium | 6.7 | 2022-10-07 | In cpu dvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution priv… |
CVE-2022-32590 | Medium | 6.7 | 2022-10-07 | In wlan, there is a possible use after free due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-32589 | High | 7.5 | 2022-10-07 | In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. This could lead to remote denial of service with no additiona… |
CVE-2022-26475 | Medium | 6.7 | 2022-10-07 | In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-39222 | Critical | 9.3 | 2022-10-06 | Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accept… |
CVE-2022-38817 | High | 7.5 | 2022-10-03 | Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data. |
CVE-2022-36025 | Critical | 9.1 | 2022-09-24 | Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An e… |
CVE-2022-31006 | High | 7.5 | 2022-09-09 | indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an att… |
CVE-2022-31020 | High | 8.8 | 2022-09-06 | Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request hand… |
CVE-2022-35942 | Critical | 9.3 | 2022-08-12 | Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to… |
CVE-2022-0670 | Critical | 9.1 | 2022-07-25 | A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vul… |
CVE-2022-34632 | Critical | 9.1 | 2022-07-18 | Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/RocketCore.scala. |
CVE-2022-31105 | High | 8.3 | 2022-07-12 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerab… |
CVE-2022-31080 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31079 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31078 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31075 | Medium | 4.9 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31074 | Medium | 4.5 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31073 | Medium | 6.5 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31077 | Medium | 4.0 | 2022-06-27 | KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a… |
CVE-2022-31076 | Medium | 4.2 | 2022-06-27 | KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a… |
CVE-2022-31030 | Medium | 5.5 | 2022-06-09 | containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containe… |
CVE-2022-29162 | Medium | 5.9 | 2022-05-17 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc… |
CVE-2022-24778 | High | 7.5 | 2022-03-25 | The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by co… |
CVE-2022-24777 | High | 7.5 | 2022-03-25 | grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to… |
CVE-2022-24769 | Medium | 5.9 | 2022-03-24 | Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 2… |
CVE-2022-26652 | Medium | 6.5 | 2022-03-10 | NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server befor… |
CVE-2022-23648 | High | 7.5 | 2022-03-03 | containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where… |
CVE-2022-24450 | High | 8.8 | 2022-02-08 | NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically… |
CVE-2021-43816 | High | 8.0 | 2022-01-05 | containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5… |
CVE-2021-43832 | Critical | 10.0 | 2022-01-04 | Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an… |
CVE-2021-39143 | Medium | 6.6 | 2022-01-04 | Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for depl… |
CVE-2021-45702 | High | 7.5 | 2021-12-27 | An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free. |
CVE-2021-45701 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free. |
CVE-2021-23450 | High | 7.5 | 2021-12-17 | All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. |
CVE-2021-36780 | High | 8.1 | 2021-12-17 | A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance gra… |
CVE-2021-36779 | Critical | 9.6 | 2021-12-17 | A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on… |
CVE-2021-41272 | High | 7.5 | 2021-12-13 | Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the intr… |
CVE-2021-43784 | Medium | 6.0 | 2021-12-06 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization syst… |
CVE-2021-43783 | High | 8.5 | 2021-11-29 | @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a… |
CVE-2021-43776 | High | 7.4 | 2021-11-26 | Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into… |
CVE-2021-43669 | High | 7.5 | 2021-11-18 | A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This b… |
CVE-2021-43667 | High | 7.5 | 2021-11-18 | A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and se… |
CVE-2021-41190 | Low | 3.0 | 2021-11-17 | The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification vers… |
CVE-2021-41131 | High | 7.5 | 2021-10-19 | python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vul… |
CVE-2021-41151 | Medium | 6.8 | 2021-10-18 | Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaf… |
CVE-2021-41103 | High | 7.8 | 2021-10-04 | containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root d… |
CVE-2021-39228 | Medium | 6.5 | 2021-09-17 | Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Iss… |
CVE-2021-36157 | Medium | 5.3 | 2021-08-03 | An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to cond… |
CVE-2021-32760 | Medium | 5.0 | 2021-07-19 | containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container i… |
CVE-2021-36155 | High | 7.5 | 2021-07-09 | LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause uncontrolled resource… |
CVE-2021-36154 | High | 7.5 | 2021-07-09 | HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier allows remote attackers to deny service via the delivery of many small messages within a single HTTP/… |
CVE-2021-36153 | High | 7.5 | 2021-07-09 | Mismanaged state in GRPCWebToHTTP2ServerCodec.swift in gRPC Swift 1.1.0 and 1.1.1 allows remote attackers to deny service by sending malformed requests. |
CVE-2021-32662 | Medium | 6.5 | 2021-06-03 | Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/tech… |
CVE-2021-32661 | Medium | 6.8 | 2021-06-03 | Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malic… |
CVE-2021-32660 | Medium | 6.8 | 2021-06-03 | Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@ba… |
CVE-2020-27847 | Critical | 9.8 | 2021-05-28 | A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to by… |
CVE-2021-30465 | High | 8.5 | 2021-05-27 | runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multipl… |
CVE-2021-31232 | Medium | 5.5 | 2021-04-30 | The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth… |
CVE-2021-20288 | High | 7.2 | 2021-04-15 | An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_ke… |
CVE-2021-29136 | Medium | 5.5 | 2021-04-06 | Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci u… |
CVE-2021-20206 | High | 7.2 | 2021-03-26 | An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field… |
CVE-2021-3127 | High | 7.5 | 2021-03-16 | NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled. |
CVE-2021-21334 | Medium | 6.3 | 2021-03-10 | In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through K… |
CVE-2021-21369 | Medium | 6.5 | 2021-03-09 | Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerabilit… |
CVE-2020-28466 | High | 7.5 | 2021-03-07 | This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a serv… |
CVE-2020-29662 | Medium | 5.3 | 2021-02-02 | In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path. |
CVE-2020-26290 | Critical | 9.3 | 2020-12-28 | Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveragin… |
CVE-2020-11093 | High | 7.5 | 2020-12-24 | Hyperledger Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In Hyperledger Indy before version 1.12.4, there… |
CVE-2020-26273 | Medium | 5.2 | 2020-12-16 | osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sqlite's ATTACH verb… |
CVE-2020-9301 | High | 8.8 | 2020-12-11 | Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnera… |
CVE-2020-15257 | Medium | 5.2 | 2020-12-01 | containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the con… |
CVE-2020-26892 | Critical | 9.8 | 2020-11-06 | The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled. |
CVE-2020-26521 | High | 7.5 | 2020-11-06 | The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code). |
CVE-2020-15157 | Medium | 6.1 | 2020-10-16 | In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the… |
CVE-2020-26149 | High | 7.5 | 2020-09-30 | NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server. |
CVE-2020-13794 | Medium | 4.3 | 2020-09-30 | Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor. |
CVE-2020-15163 | High | 8.7 | 2020-09-09 | Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which faile… |
CVE-2020-15687 | High | 7.5 | 2020-08-31 | Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious entity, with root access in the Service… |
CVE-2020-13788 | Medium | 4.3 | 2020-07-15 | Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's… |
CVE-2020-11081 | Medium | 5.3 | 2020-07-10 | osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory… |
CVE-2020-10753 | Medium | 5.4 | 2020-06-26 | A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHead… |
CVE-2020-10736 | High | 8.0 | 2020-06-22 | An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access… |
CVE-2020-10750 | High | 7.1 | 2020-06-19 | Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw… |